Researchers from the Google-owned firm conclude that Sandworm personas are linked to several recent attacks on critical infrastructure. 

U.S. authorities disrupted the infrastructure used by a notorious Russian hacking group linked to the country's military intelligence agency.

Ukrainian officials say Russian hackers targeted counter-intelligence and law enforcement data during the first half of this year.

Dubbed "Cadet Blizzard," the hacking group carried out operations targeting Ukrainian infrastructure in the run-up to the Russian invasion.

Researches believe the destructive malware is the work of Sandworm, a Russian military unit suspected in a series of Ukrainian cyberattacks.

The material includes information on non-related people and phone records, and Russian businessmen possibly associated with the Trump administration, according to a court document.

Strontium — a group linked to Russian military intelligence — was using the domains to target Ukrainian institutions, Microsoft said.

The botnet was being assembled by Russia's foreign intelligence agency, the GRU, Attorney General Merrick Garland said at a news conference.

The Treasury Department sanctioned 26 Russia- and Ukraine-based individuals and seven entities.

The "large-scale modular malware framework" has largely replaced the "VPNFilter" tools that Sandworm used before they were disrupted in 2018.